Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

decaporg/decap-cms

              main @ 2f5c54d
            

Fixes

CVEs

CRITICAL

Peak severity

14.3%

Coverage

Highlights

Auth Bypass: 7 prior fixes. Scrutinize any change in this area.

src/backends/backend.js: most-fixed (3 issues). Treat as high-risk during review.

9 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Incomplete collaborator verification allowed unauthorized users to bypass authentication boundaries and access the CMS dashboard. Ensuring robust API-driven verification of repository permissions is critical on every load.

Path Traversal: User-controlled slugs and string interpolation were utilized to construct file paths without robust validation, allowing malicious files to be written outside the intended media and collection directories.

Remote Code Execution: Using an outdated version of the simple-git library left the local development proxy server vulnerable to command injection via shell metacharacters in git operations.